Privacy policy

Your account. When you sign in, our sign-in provider (Clerk) gives us your email address, the name on your profile, your avatar image and your username if you set one. That is what appears beside your team in a league.

What you do in the app. The leagues you create or join, the name you give your team, your draft picks, the messages and reactions you post in a league's chat, and the friend requests you send and receive.

Notifications. A record of each alert the app sends you (a friend request, a draft turn, a league change), when you read it, and whether it also went out by email. Your email preferences, and a private token that makes the unsubscribe link in each email work.

Push notifications, if you turn them on. When you switch on push for a browser, that browser hands us a delivery address and two keys. We store those so we can send the alert; they identify a browser, not a person, and are removed when the browser unsubscribes.

A chat webhook, if a commissioner adds one. A commissioner can paste a Discord or Slack webhook URL so their league's standings post to a channel they already use. We store the URL and send only draft and standings updates to it.

Server logs and diagnostics. Like every website, our host records the requests it serves, including IP addresses, for security and to keep the site running. Page views and performance are measured without cookies or identifiers (see below). If error reporting is switched on, a crash sends the error and the page it happened on — configured to send no personal information.

We do not collect your date of birth, phone number, location, payment details (there is nothing to pay for), contacts, or anything from your device beyond what is listed here.

• To run your leagues — showing your team, scoring your picks, ranking the leaderboard, and telling you when it is your turn. This is the service you signed up for (performance of a contract).
• To send the alerts you have not turned off — in the app, by email, and by push where you enabled it. Email and push are each controlled from your account page; push is only ever enabled by you, in the browser's own permission prompt (consent).
• To keep the site secure and working — logs, error reports and aggregate performance measurement (legitimate interest).

We do not use your data for advertising, do not sell it, do not build profiles of you, and do not make automated decisions about you.

Inside a league, its members can see your display name, username, avatar, team name, roster, points and the messages you post there.

If a commissioner makes a league public, anyone with the link can see the league page — its name, standings, team names, and the display names and avatars of its members. Leagues are private by default; the setting is the commissioner's, and it is labelled on the league settings page.

A join link shows the league's name, season, seat count and the commissioner's display name to whoever holds the invite code, so they know what they are joining.

Season and player pages are about the television cast, not about you. Your account page, career totals, friends and notifications are visible only to you.

These companies process data on our behalf, under their own agreements with us. Each is based in the United States and may store data there.

• Clerk — Sign-in and account management. Holds your login credentials and profile; sets the session cookies that keep you signed in. Their privacy policy.
• Vercel — Hosting, and the cookieless Web Analytics and Speed Insights that report page views and performance without identifying you. Their privacy policy.
• Resend — Sends the notification emails you have not turned off. Their privacy policy.
• Sentry — Error reporting, when the operator has it switched on. Configured to send no personal information with a report. Their privacy policy.
• Discord or Slack — only if a commissioner connects a webhook. What we send is the league's draft and standings; what they do with it is governed by their terms.

Season results and cast photos come from public fan sites and news feeds, fetched by our server. Your browser does not contact those sites when you use Comp Beast; cast photos are served through our own image resizer.

We do not share your data with anyone else, except where the law requires it or to protect the site and its users from abuse.

The only cookies set are the ones that keep you signed in. Page views and performance are measured by Vercel's cookieless analytics, which does not identify you or follow you to other sites. There is no advertising and no tracking, which is why there is no cookie banner. The full list is in the cookie policy.

• Your account and everything in it — until you delete your account (below).
• A league — until its commissioner deletes it. When that happens, each manager's final points and rank are kept on their own account as a career record, because the points a person scored are theirs; the league itself, its rosters and its chat are removed.
• Messages you delete — hidden from the feed at once and removed with your account.
• Push subscriptions — until the browser unsubscribes, you turn push off, or the push service tells us the browser is gone.
• Host logs and error reports — for the periods our providers keep them, typically weeks to a few months.

Wherever you live, you can ask to see the data we hold about you, correct it, have it deleted, or receive a copy of it. In the European Economic Area, the United Kingdom and some other places these are legal rights, and you can also object to processing based on legitimate interest and complain to your data protection authority.

• Correct your profile — name, avatar, username and email are edited through the account menu in the header, which opens your sign-in provider's profile.
• Control notifications — email categories and push are switched on your account page; every email also carries a one-click unsubscribe link.
• Delete your account and data — from the bottom of your account page, in the app, at any time. It takes effect immediately; see the next section for exactly what happens.
• Anything else — contact us using the details at the foot of this page. We answer within 30 days.

When you delete your account:

• Your sign-in is deleted at our provider, so you can no longer sign in and no one can sign in as you.
• Your email, name, username, avatar, email preferences, unsubscribe token, push subscriptions, friendships, notifications and career records are erased.
• Every message you posted in a league chat is removed.
• In leagues whose draft has not started, your team and seat are removed. In leagues already drafted or in play, your team stays on the board — the other managers' standings depend on it — but it is no longer linked to you and shows no name.
• In leagues you commissioned, the role passes to the longest-standing other member. A league with no other members is deleted.
• The scoring ledger's audit trail keeps a record that a change was made, but nothing that identifies you.

Deletion cannot be undone. Our providers remove their copies on their own schedules.

Comp Beast is not for children under 13, and we do not knowingly collect anything from them. If you are under 16 and live in the European Economic Area or the United Kingdom, you may use Comp Beast only with a parent or guardian's permission. If you believe a child has an account, contact us and we will delete it.

Sign-in and password handling are done by Clerk, which stores passwords hashed; we never see them. Everything travels over HTTPS. Unsubscribe links and invite codes are random tokens that grant only the one thing they are for. No system is perfectly secure; if we learn of a breach affecting you, we will tell you.

If we change what we collect or how we use it, this page changes and the date at the top moves. For a change that reduces your rights, we will tell you in the app before it takes effect.

Open an issue at the project's public repository — for anything you would rather not post publicly, say so in the issue and we will move it to a private channel. The operator's details are at the foot of this page.